The State of Cybersecurity in Namibia in 2026: Threats, Gaps and Progress

Cybersecurity in Namibia at a Glance (November 2026)

What NAM-CSIRT's Numbers Really Show

NAM-CSIRT, the Namibia Cyber Security Incident Response Team at CRAN, publishes the only regular national figures, on its statistics page, in an annual Namibia Cybersecurity Landscape Report and in quarterly newsletters. They are worth reading closely, because they are often reported as “cyberattacks” when most of them are something else. The team counts three different things:

• Cyber events are observations from sensors: mostly sinkhole and honeypot data shared by the Shadowserver Foundation, plus NAM-CSIRT's own monitoring. A typical event is an infected computer or phone in Namibia trying to contact a criminal server that researchers have taken over. Events show how much malware is running on Namibian networks, not how many attacks succeeded.
• Vulnerabilities are internet-facing devices and services in Namibia that scans found to be exposed or out of date, such as routers whose remote management is open to the internet. They are counts of detections, not of distinct organisations.
• Incidents are confirmed security incidents that NAM-CSIRT handled. There are far fewer: 7 in 2024, five of them related to ransomware, and 5 in 2025.

The annual figures come from the Landscape Reports and the quarterly figures from the newsletters. The quarters do not add up exactly to the annual totals, so compare like with like.

What stands out is not the size of the totals but what they consist of. In both the second and the third quarter of 2026, about 320 000 of the roughly half a million vulnerability detections were open CWMP services: the remote-management protocol that internet providers use to configure customer routers. Openly accessible NTP and Telnet services followed with roughly 40 000 to 50 000 detections each, and remote desktop (RDP) reachable from the internet rose to 7 537 detections in the third quarter. Most events come from sinkholes, which means infected devices; in late 2025 NAM-CSIRT also detected Android-based devices infected with the BADBOX 2.0 botnet.

Read this way, the numbers describe a country with a lot of exposed and poorly maintained equipment, much of it routers and small-office devices, rather than one under constant successful attack. That is the more useful message for a business, because those open services and outdated devices are exactly what attackers scan for first.

The Incidents That Shaped the Debate

The confirmed incidents of the past two years hit telecoms, local and central government and critical infrastructure. Most were ransomware attacks with “double extortion”: the criminals copy data before encrypting systems, then threaten to publish it if no ransom is paid.

Criminal leak sites list more Namibian organisations than this, including private companies. Those listings are unverified claims by criminals, so we do not repeat them here.

Two lessons run through these cases. First, the organisations did not say how the attackers got in, but the groups involved are well documented internationally: Akira and INC Ransom are known for entering through VPN and remote-access systems that lack multi-factor authentication or have unpatched flaws, and through phishing. Second, the damage goes far beyond the ransom: leaked customer and staff data, demands for disclosure from opposition parties and the media and, under the last published draft of the Data Protection Bill, a duty to tell the people affected.

Who Is Responsible for Cybersecurity in Namibia

• The Ministry of Information and Communication Technology (MICT) sets policy and is responsible for the Cybercrime Bill and the Data Protection Bill. Emma Theofelus is the Minister; Wenzel Kavaka became Deputy Minister in April 2026.
• CRAN and NAM-CSIRT. NAM-CSIRT is the national point of contact for reporting incidents. It issues advisories and vulnerability bulletins, coordinates the response to major incidents and runs training and cyber drills. Its constituency is licensed communication service providers, critical infrastructure operators and national entities, and it does not serve their customers directly. CRAN's CEO, Emilia Nghikembua, also heads NAM-CSIRT. The ministry committed N$ 20 million over three years in May 2023 to set the team up.
• The National Cyber Security Incident Management Guidelines, launched by the Minister in Ondangwa on 29 April 2026, tell government offices, critical infrastructure operators and private organisations whose systems matter nationally how to prepare for, handle and report incidents. They are aligned with ISO/IEC 27001 and the NIST Cybersecurity Framework, but they are explicitly non-binding.
• The Bank of Namibia sets cybersecurity rules for the financial sector: Determination BID-30 on information security for banks, most recently reissued in 2026, and PSD-12 on operational and cybersecurity standards in the National Payment System, first in force from July 2023. Its April 2025 Financial Stability Report named cyber risk one of the top risks to financial stability.
• The Namibian Police receives criminal complaints and has a Cybercrime Unit. Until a cybercrime law exists, offences committed online are prosecuted under existing laws such as the Electronic Transactions Act and the Communications Act.
• Cabinet and the public service. In November 2025 Cabinet approved proposals for government CSIRTs, security operations centres across government and targeted cyber training for government IT staff, coordinated by the Office of the Prime Minister. In June 2026 NIPAM signed a three-year agreement to build cyber awareness and skills in the public service.

The National Cybersecurity Strategy and Awareness Raising Plan 2022–2027, approved by Cabinet in 2022 and launched in March 2023, ties these together. Its aims are to protect critical information infrastructure, educate the most vulnerable internet users and build cooperation on cybersecurity across government, business and society, and it called for the national response team that now exists. By October 2024 the ministry reported a register of critical infrastructure and expanded cybersecurity courses at universities.

How Namibia Compares Internationally

The best-known benchmark is the International Telecommunication Union's Global Cybersecurity Index. Its fifth edition, published in September 2024, placed Namibia in Tier 4, “Evolving”, with 36.93 out of 100. In the previous edition (2020) Namibia scored 11.47, although the method has changed since.

The pattern is clear. Namibia scores well on organisational measures, such as its strategy and responsible institutions, and below the African average on everything else: laws, technical capacity, skills development and cooperation. In southern Africa, South Africa and Zambia reached Tier 2 and Botswana, Eswatini, Malawi and Mozambique Tier 3, while Angola, Lesotho and Zimbabwe share Tier 4 with Namibia.

Some progress since then, such as NAM-CSIRT's official launch and the 2026 incident guidelines, is not yet reflected, because the ITU has not started collecting data for a sixth edition. Interpol's Africa Cyberthreat Assessment Report 2025 is more generous: it names Namibia, alongside South Africa and Botswana, among the southern African countries investing substantially in cybersecurity awareness and security technology.

The Legal Gap: Two Bills Still Waiting

The biggest gap is legal. Namibia has no dedicated cybercrime law and no data protection law. The Electronic Transactions Act of 2019 makes electronic contracts and evidence valid and regulates when service providers are liable for their clients' content, but it does not create hacking or phishing offences.

• The Cybercrime Bill would criminalise unauthorised access, phishing, computer fraud, identity theft and cyber extortion, and give investigators powers to preserve and obtain data. After consultations from February to April 2026, the Minister said in July 2026 that it was being finalised. Namibia signed the UN Convention against Cybercrime in Hanoi in October 2025 and has said the bill will be aligned with it. Our article on Namibia's Cybercrime Bill explains the draft in detail.
• The Data Protection Bill would set rules for how organisations collect, secure and share personal information, and when they must report a breach. It too was being finalised in mid-2026. Our guide to Namibia's Data Protection Bill explains what it would mean for your website.

Until both are passed, there is no general legal duty to report a breach of personal data or to tell the people affected, and online crimes have to be squeezed into older laws. NAM-CSIRT's 2025 Landscape Report lists enacting the cybercrime, data protection and critical infrastructure rules among its recommendations.

Skills, Scams and Awareness

Officials have pointed to a shortage of local expertise, for example in cyber law, although no official figure for the skills gap has been published. The education pipeline is growing:

• NUST offers a Bachelor of Computer Science in Cyber Security and, from 2026, new honours degrees in Digital Forensics and in Information Security, plus master's specialisations in forensic computing and information security.
• IUM lists a Postgraduate Diploma and a Master of Science in Cybersecurity.
• NAM-CSIRT trains its constituents, for example with DNS resilience training for nine SADC countries in Windhoek in February 2026 and an incident-handling masterclass during Cybersecurity Awareness Month in October 2026, and takes part in regional cyber drills.

Awareness is the harder part, because many losses come from tricking people rather than breaking systems. NAM-CSIRT's 2025 report describes deepfake investment scams, deepfake videos of senior officials, SMS messages that imitate delivery companies, phishing on Telegram and fraud using remote-access apps such as AnyDesk. The Bank of Namibia reports that N$ 73.9 million was lost to fraud in the National Payment System in 2025, mainly through vishing (fraudulent phone calls) and phishing.

What It Means for Namibian Businesses

For a small or medium business, the national picture leads to a few practical conclusions:

1. Size is no protection. Ransomware groups and automated scanners do not pick victims by size; they look for whatever is open and unpatched.
2. Know what you expose to the internet. The open remote-management, Telnet and remote-desktop services in NAM-CSIRT's figures are exactly what criminals look for. Find out which of your devices and services can be reached from outside, and close what you do not need.
3. Patch firewalls and VPNs first. The FortiBleed warning of June 2026 showed how quickly a firewall becomes a way in. Install security updates for network devices as soon as they are released, and change their admin passwords after any warning.
4. Turn on multi-factor authentication for email, VPN, remote access, banking and hosting accounts. NAM-CSIRT recommends making it mandatory for internet-facing systems.
5. Scan regularly. After the Telecom Namibia breach, NAM-CSIRT advised organisations to run regular vulnerability scans. A scan of your servers, websites and software finds missing updates and risky settings before attackers do. That is what our vulnerability scanning service does, with every finding checked by a certified cybersecurity analyst.
6. Keep a backup that ransomware cannot reach. At least one copy should be offline or separate from your network, and you should test restoring it.
7. Train people for scams, not just systems. Most money is lost to phone and email fraud. Confirm every change of banking details by phone, on a number you already have.

Our cyber security checklist for Namibian SMEs goes through each step in more detail and explains what to do, and whom to contact, after an incident.

What to Watch in 2027

• The two bills: whether the Cybercrime Bill and the Data Protection Bill are finally passed, and what the final texts say about breach notification and the duties of service providers.
• The UN Convention against Cybercrime: the Minister has promised early ratification.
• Critical infrastructure: binding rules, and sector response teams for finance, energy, transport, health and telecoms, as NAM-CSIRT recommends.
• Government security operations centres under the Cabinet decision of November 2025.
• A new Global Cybersecurity Index, once the ITU starts collecting data for its sixth edition.
• Ransomware disclosure: after the airports company and the defence ministry in 2026, how openly future incidents are reported will say a lot about public trust.

Sources and Date

This overview is based on publicly available information as of 9 November 2026: NAM-CSIRT's Namibia Cybersecurity Landscape Reports for 2024 and 2025 and its quarterly constituent newsletters; the ITU Global Cybersecurity Index 2024; Interpol's Africa Cyberthreat Assessment Report 2025; statements by Namibia Airports Company; Bank of Namibia reports; and reporting by The Namibian, New Era, The Brief and ITWeb Africa. Figures from different reports do not always reconcile, so we quote each report's own numbers. This article is general information, not legal advice or a security assessment of your own systems.